disable the iptables setting of yurthub component by default

cmd/yurthub/app/options/options.go

@@ -111,7 +111,7 @@ func NewYurtHubOptions() *YurtHubOptions {
 		RootDir:                   filepath.Join("/var/lib/", projectinfo.GetHubName()),
 		EnableProfiling:           true,
 		EnableDummyIf:             true,
-		EnableIptables:            true,
+		EnableIptables:            false,
 		HubAgentDummyIfName:       fmt.Sprintf("%s-dummy0", projectinfo.GetHubName()),
 		DiskCachePath:             disk.CacheBaseDir,
 		AccessServerThroughHub:    true,
@@ -201,6 +201,7 @@ func (o *YurtHubOptions) AddFlags(fs *pflag.FlagSet) {
 	fs.BoolVar(&o.EnableProfiling, "profiling", o.EnableProfiling, "enable profiling via web interface host:port/debug/pprof/")
 	fs.BoolVar(&o.EnableDummyIf, "enable-dummy-if", o.EnableDummyIf, "enable dummy interface or not")
 	fs.BoolVar(&o.EnableIptables, "enable-iptables", o.EnableIptables, "enable iptables manager to setup rules for accessing hub agent")
+	fs.MarkDeprecated("enable-iptables", "It is planned to be removed from OpenYurt in the future version")
 	fs.StringVar(&o.HubAgentDummyIfIP, "dummy-if-ip", o.HubAgentDummyIfIP, "the ip address of dummy interface that used for container connect hub agent(exclusive ips: 169.254.31.0/24, 169.254.1.1/32)")
 	fs.StringVar(&o.HubAgentDummyIfName, "dummy-if-name", o.HubAgentDummyIfName, "the name of dummy interface that is used for hub agent")
 	fs.StringVar(&o.DiskCachePath, "disk-cache-path", o.DiskCachePath, "the path for kubernetes to storage metadata")

cmd/yurthub/app/options/options_test.go

@@ -53,7 +53,7 @@ func TestNewYurtHubOptions(t *testing.T) {
 		RootDir:                   filepath.Join("/var/lib/", projectinfo.GetHubName()),
 		EnableProfiling:           true,
 		EnableDummyIf:             true,
-		EnableIptables:            true,
+		EnableIptables:            false,
 		HubAgentDummyIfName:       fmt.Sprintf("%s-dummy0", projectinfo.GetHubName()),
 		DiskCachePath:             disk.CacheBaseDir,
 		AccessServerThroughHub:    true,

pkg/yurthub/certificate/manager/manager.go

@@ -123,8 +123,12 @@ func (hcm *yurtHubCertManager) Ready() bool {
 		errs = append(errs, apiServerClientCertNotReadyError)
 	}
 
-	if exist, _ := util.FileExists(hcm.YurtClientCertificateManager.GetCaFile()); !exist {
-		errs = append(errs, caCertIsNotReadyError)
+	if exist, err := util.FileExists(hcm.YurtClientCertificateManager.GetCaFile()); !exist {
+		if err == nil {
+			errs = append(errs, caCertIsNotReadyError)
+		} else {
+			errs = append(errs, err)
+		}
 	}
 
 	if hcm.GetHubServerCert() == nil {

pkg/yurthub/certificate/manager/manager_test.go

@@ -24,11 +24,17 @@ import (
 	"testing"
 	"time"
 
+	"github.com/pkg/errors"
 	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/client-go/tools/clientcmd"
+	certutil "k8s.io/client-go/util/cert"
+	"k8s.io/klog/v2"
 
 	"github.com/openyurtio/openyurt/cmd/yurthub/app/options"
 	"github.com/openyurtio/openyurt/pkg/projectinfo"
+	kubeconfigutil "github.com/openyurtio/openyurt/pkg/util/kubeconfig"
 	"github.com/openyurtio/openyurt/pkg/yurthub/certificate/testdata"
+	"github.com/openyurtio/openyurt/pkg/yurthub/util"
 )
 
 func TestGetHubServerCertFile(t *testing.T) {
@@ -103,11 +109,38 @@ func TestReady(t *testing.T) {
 		if mgr.Ready() {
 			return true, nil
 		}
+
+		if exist, err := util.FileExists(mgr.GetCaFile()); !exist {
+			if err != nil {
+				return false, err
+			}
+
+			if exist, err := util.FileExists(mgr.GetHubConfFile()); err != nil {
+				return false, nil
+			} else if exist {
+				klog.Infof("%s file already exists, so use it to create ca file", mgr.GetHubConfFile())
+				hubKubeConfig, err := clientcmd.LoadFromFile(mgr.GetHubConfFile())
+				if err != nil {
+					return false, err
+				}
+
+				cluster := kubeconfigutil.GetClusterFromKubeConfig(hubKubeConfig)
+				if cluster != nil {
+					if err := certutil.WriteCert(mgr.GetCaFile(), cluster.CertificateAuthorityData); err != nil {
+						return false, errors.Wrap(err, "couldn't save the CA certificate to disk")
+					}
+				} else {
+					return false, errors.Errorf("couldn't prepare ca.crt(%s) file", mgr.GetCaFile())
+				}
+			}
+		}
 		return false, nil
 	})
 
 	if err != nil {
 		t.Errorf("certificates are not ready, %v", err)
+		mgr.Stop()
+		return
 	}
 
 	mgr.Stop()

pkg/yurthub/network/dummyif_linux.go

@@ -35,7 +35,7 @@ type dummyInterfaceController struct {
 	netlink.Handle
 }
 
-// NewDummyInterfaceManager returns an instance for create/delete dummy net interface
+// NewDummyInterfaceController returns an instance for create/delete dummy net interface
 func NewDummyInterfaceController() DummyInterfaceController {
 	return &dummyInterfaceController{
 		Handle: netlink.Handle{},

pkg/yurthub/network/network.go

@@ -64,12 +64,16 @@ func (m *NetworkManager) Run(stopCh <-chan struct{}) {
 			select {
 			case <-stopCh:
 				klog.Infof("exit network manager run goroutine normally")
-				if err := m.iptablesManager.CleanUpIptablesRules(); err != nil {
-					klog.Errorf("failed to cleanup iptables, %v", err)
+				if m.enableIptables {
+					if err := m.iptablesManager.CleanUpIptablesRules(); err != nil {
+						klog.Errorf("failed to cleanup iptables, %v", err)
+					}
 				}
 				err := m.ifController.DeleteDummyInterface(m.dummyIfName)
 				if err != nil {
 					klog.Errorf("failed to delete dummy interface %s, %v", m.dummyIfName, err)
+				} else {
+					klog.Infof("remove dummy interface %s successfully", m.dummyIfName)
 				}
 				return
 			case <-ticker.C: